@swimmingliu/autovpn 2.0.3 → 2.1.0

package/dist/pipeline/egress.js

@@ -0,0 +1,372 @@
+/**
+ * One egress authority for the crawl stages (credential + url extraction).
+ *
+ * Before this module the two stages disagreed: each had its own env-only,
+ * default-off proxy switch, the credential flow built its CommContext without
+ * the egress object so its curl/TLS fallback was dead code, and neither stage
+ * noticed that the vendor had started answering with a block page.
+ *
+ * Policy, in the order the operator asked for it:
+ *   - `proxy` (the default) crawls through the upstream proxy. When the proxy
+ *     is not listening the run drops to direct rather than failing every
+ *     request, and a later block on direct switches back to the proxy.
+ *   - `auto` starts direct and pins the proxy for the rest of the run the
+ *     first time a response looks like an IP block.
+ *   - `direct` never uses a proxy. It is the explicit override.
+ *
+ * Per-node measurement (speedtest/availability) deliberately does NOT use this
+ * module: those transports must reach the node itself, not the crawl proxy.
+ */
+import net from 'node:net';
+import { spawn as nodeSpawn } from 'node:child_process';
+import { fetch as upstreamFetch, ProxyAgent } from 'undici';
+export const DEFAULT_PROXY_URL = 'http://127.0.0.1:7897';
+const DISABLED_VALUES = new Set(['', 'off', 'none', 'false', '0', 'no', 'direct']);
+const ENABLED_VALUES = new Set(['1', 'true', 'yes', 'on']);
+function normalizeMode(value) {
+    const text = String(value ?? '').trim().toLowerCase();
+    if (text === 'proxy' || text === 'upstream')
+        return 'proxy';
+    if (text === 'auto' || text === 'fallback')
+        return 'auto';
+    if (text === 'direct' || text === 'off' || text === 'none')
+        return 'direct';
+    return null;
+}
+/**
+ * Resolve the crawl egress policy.
+ *
+ * `VPN_AUTOMATION_PROXY_MODE` is the current knob. The older
+ * `VPN_AUTOMATION_USE_UPSTREAM_PROXY` boolean still works: an explicit false
+ * means direct, an explicit true means proxy. The standard proxy variables are
+ * a URL fallback only, so a shell that exports HTTPS_PROXY for unrelated tools
+ * does not silently change the crawl's transport mode.
+ */
+export function resolveEgressPolicy(env = process.env) {
+    const explicit = normalizeMode(env.VPN_AUTOMATION_PROXY_MODE);
+    const legacyRaw = String(env.VPN_AUTOMATION_USE_UPSTREAM_PROXY ?? '').trim().toLowerCase();
+    const legacy = legacyRaw
+        ? (ENABLED_VALUES.has(legacyRaw) ? 'proxy' : (DISABLED_VALUES.has(legacyRaw) ? 'direct' : null))
+        : null;
+    const configured = String(env.VPN_AUTOMATION_UPSTREAM_PROXY ?? '').trim();
+    const standard = String(env.HTTPS_PROXY ?? env.https_proxy ?? env.HTTP_PROXY ?? env.http_proxy ?? env.ALL_PROXY ?? env.all_proxy ?? '').trim();
+    const candidate = configured || standard;
+    // An UNSET candidate falls back to the default proxy; only an explicit
+    // disable token ('off', 'none', '0', ...) turns the proxy off. Treating ''
+    // as disabled would make the default mode direct.
+    const proxyUrl = candidate && DISABLED_VALUES.has(candidate.toLowerCase())
+        ? ''
+        : (candidate || DEFAULT_PROXY_URL);
+    // An explicitly disabled proxy URL cannot serve any mode that needs one.
+    const mode = explicit ?? legacy ?? 'proxy';
+    if (!proxyUrl)
+        return { mode: 'direct', proxyUrl: '' };
+    return { mode, proxyUrl };
+}
+/** Status codes a vendor or its CDN uses when it stops serving this client. */
+const BLOCK_STATUS = new Set([403, 407, 429, 451, 503]);
+const BLOCK_BODY_PATTERN = /封禁|封鎖|封锁|禁止访问|禁止訪問|访问受限|訪問受限|您的IP|你的IP|IP\s*被|异常访问|異常訪問|请求过于频繁|請求過於頻繁|操作频繁|操作頻繁|too\s*many\s*requests|rate\s*limit|access\s*denied|forbidden|blocked|cf-browser-verification|just\s*a\s*moment|attention\s*required|captcha/i;
+/** Classify a response or transport error for the switch decision. */
+export function classifyEgressFailure(input) {
+    const status = Number(input.status ?? 0);
+    if (BLOCK_STATUS.has(status))
+        return 'blocked';
+    if (input.body && BLOCK_BODY_PATTERN.test(input.body.slice(0, 4096)))
+        return 'blocked';
+    if (input.error !== undefined) {
+        const text = errorText(input.error);
+        if (/econnreset|econnrefused|etimedout|enotfound|ehostunreach|enetunreach|socket\s*hang\s*up|fetch\s*failed|abort|timeout|und_err_/i.test(text)) {
+            return 'transient';
+        }
+        return 'fatal';
+    }
+    // A 2xx with no usable body is not a block on its own: the vendor answers an
+    // empty body for a blank `code` parameter too. The round-level empty sweep
+    // is what escalates that into a switch.
+    return status >= 400 ? 'transient' : 'fatal';
+}
+function errorText(error) {
+    if (error instanceof Error) {
+        const cause = error.cause;
+        return `${error.name}: ${error.message}${cause ? ` ${errorText(cause)}` : ''}`.toLowerCase();
+    }
+    return String(error ?? '').toLowerCase();
+}
+/**
+ * True when the failure is the proxy itself refusing the connection, not the
+ * target host. Only then may the run fall back to direct.
+ */
+export function isProxyUnreachable(error) {
+    return /econnrefused|enotfound|ehostunreach|enetunreach|proxy\s*(connection|connect|tunnel)|und_err_proxy|err_proxy/i.test(errorText(error));
+}
+function isTlsFailure(error) {
+    return /ssl|tls|certificate|handshake/i.test(errorText(error));
+}
+const defaultSpawn = nodeSpawn;
+/**
+ * curl handles a proxy or an intercepted TLS chain that Node's fetch rejects.
+ * The URL travels through stdin so it never lands in a process argument list.
+ */
+export function defaultCurlFetch(url, proxyUrl, spawn, timeoutSeconds = 20) {
+    const run = spawn ?? defaultSpawn;
+    const args = [
+        '--fail', '--silent', '--show-error', '--location',
+        '--max-time', String(Math.max(1, Math.trunc(timeoutSeconds))),
+        '--connect-timeout', '10',
+        '--insecure', '--http1.1', '--config', '-'
+    ];
+    if (proxyUrl)
+        args.push('--proxy', proxyUrl);
+    else
+        args.push('--noproxy', '*');
+    const child = run('curl', args, { stdio: ['pipe', 'pipe', 'pipe'] });
+    let stdout = '';
+    let stderr = '';
+    child.stdout?.on('data', (chunk) => { stdout += String(chunk); });
+    child.stderr?.on('data', (chunk) => { stderr += String(chunk); });
+    const completion = new Promise((resolve, reject) => {
+        child.on('error', reject);
+        child.on('close', (code) => {
+            if (code === 0)
+                resolve(stdout);
+            else
+                reject(new Error((stderr || stdout || 'curl TLS fallback failed').trim()));
+        });
+    });
+    child.stdin?.write(`url = ${JSON.stringify(url)}\n`);
+    child.stdin?.end();
+    return completion;
+}
+/** A TCP connect is enough to know whether a local proxy is listening. */
+export function probeProxy(proxyUrl, timeoutMs = 1500) {
+    let target;
+    try {
+        target = new URL(proxyUrl);
+    }
+    catch {
+        return Promise.resolve(false);
+    }
+    const port = Number(target.port) || (target.protocol === 'https:' ? 443 : 80);
+    return new Promise((resolve) => {
+        let settled = false;
+        const socket = net.connect({ host: target.hostname, port });
+        const finish = (reachable) => {
+            if (settled)
+                return;
+            settled = true;
+            socket.destroy();
+            resolve(reachable);
+        };
+        socket.setTimeout(timeoutMs);
+        socket.once('connect', () => finish(true));
+        socket.once('timeout', () => finish(false));
+        socket.once('error', () => finish(false));
+    });
+}
+const FAILED_TEXT = (url, transport, status = 0, blocked = false) => ({ text: '', url, ok: false, status, transport, blocked });
+/**
+ * A run-scoped transport choice. One session per source: the switch is sticky
+ * so a blocked run does not oscillate between transports on every request.
+ */
+export class EgressSession {
+    policy;
+    switches = [];
+    /** HTTP attempts actually issued, including retries and fallbacks. */
+    attempts = 0;
+    current;
+    dispatcher = null;
+    fetchImpl;
+    curlFetch;
+    onSwitch;
+    proxyEverReachable;
+    /** A request has already been routed through the proxy this run. */
+    proxyAttempted = false;
+    closed = false;
+    constructor(policy, current, proxyReachable, options) {
+        this.policy = policy;
+        this.current = current;
+        this.proxyEverReachable = proxyReachable;
+        this.fetchImpl = options.fetchImpl;
+        this.curlFetch = options.curlFetch;
+        this.onSwitch = options.onSwitch;
+    }
+    static async open(env, options = {}) {
+        const policy = resolveEgressPolicy(env ?? {});
+        if (policy.mode === 'direct' || !policy.proxyUrl) {
+            return new EgressSession(policy, 'direct', false, options);
+        }
+        if (policy.mode === 'auto') {
+            // Direct first; the first blocked response pins the proxy.
+            return new EgressSession(policy, 'direct', false, options);
+        }
+        const probe = options.probe ?? ((url) => probeProxy(url));
+        // An injected fetch is a test seam: probing a real socket would make every
+        // unit test depend on whether a local proxy happens to be listening. The
+        // injected impl decides the bytes; `probe` can still be injected to drive
+        // the unreachable-proxy fallback.
+        let reachable = Boolean(options.fetchImpl) && !options.probe;
+        if (!reachable) {
+            try {
+                reachable = await probe(policy.proxyUrl);
+            }
+            catch {
+                reachable = false;
+            }
+        }
+        // When the proxy is not listening the run starts direct. `proxyReachable`
+        // stays false so the first blocked response may still try the proxy once
+        // (a local client often starts a moment later), and a failed proxy attempt
+        // is not retried after that.
+        return new EgressSession(policy, reachable ? 'proxy' : 'direct', reachable, options);
+    }
+    get transport() {
+        return this.current;
+    }
+    /**
+     * The transport-bound fetch, for the binary (APK) downloads that need
+     * `arrayBuffer` rather than text. It carries the same proxy dispatcher as
+     * `text()`, so a configured proxy serves the APK bytes too.
+     */
+    rawFetch() {
+        return this.impl();
+    }
+    get proxyAvailable() {
+        return Boolean(this.policy.proxyUrl) && this.policy.mode !== 'direct';
+    }
+    get proxyReachable() {
+        return this.proxyEverReachable;
+    }
+    switchTo(next, reason) {
+        if (this.current === next)
+            return false;
+        // A proxy the probe found unreachable gets exactly one more chance (it may
+        // have just started listening). After that a blocked response does not
+        // bounce the run back onto a transport that already refused it.
+        if (next === 'proxy' && !this.proxyEverReachable && this.proxyAttempted)
+            return false;
+        const record = { from: this.current, to: next, reason };
+        this.current = next;
+        this.switches.push(record);
+        this.onSwitch?.(record);
+        return true;
+    }
+    /**
+     * Escalate a silent failure sweep. The vendor can answer an empty body to a
+     * banned IP instead of a 403, so a whole round with no answer is the signal.
+     */
+    reportEmptySweep(reason = 'empty_responses') {
+        if (this.current !== 'direct' || !this.proxyAvailable)
+            return false;
+        return this.switchTo('proxy', reason);
+    }
+    impl() {
+        if (this.fetchImpl)
+            return this.fetchImpl;
+        if (this.current === 'proxy' && this.policy.proxyUrl) {
+            this.dispatcher ??= new ProxyAgent({ uri: this.policy.proxyUrl, proxyTunnel: false });
+            const dispatcher = this.dispatcher;
+            return (url, init) => upstreamFetch(url, { ...init, dispatcher });
+        }
+        return (url, init) => upstreamFetch(url, { ...init });
+    }
+    async attempt(url, timeoutMs, transport) {
+        if (transport === 'proxy')
+            this.proxyAttempted = true;
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), Math.max(1, timeoutMs));
+        const fetchImpl = this.impl();
+        this.attempts += 1;
+        let response = null;
+        try {
+            response = await fetchImpl(url, { signal: controller.signal, redirect: 'follow' });
+            const status = Number(response.status ?? (response.ok === false ? 500 : 200));
+            const ok = response.ok !== false && status < 400;
+            if (!ok) {
+                // An abandoned body pins its keep-alive socket until GC; at thousands
+                // of route requests per run that exhausts the pool.
+                const body = await this.drain(response, 2048);
+                await this.cancel(response);
+                const blocked = classifyEgressFailure({ status, body }) === 'blocked';
+                if (blocked && transport === 'direct' && this.proxyAvailable) {
+                    return { ...FAILED_TEXT(url, transport, status, true), retryWith: 'proxy', reason: `blocked_direct_${status}` };
+                }
+                return FAILED_TEXT(url, transport, status, blocked);
+            }
+            const text = await response.text();
+            const blocked = classifyEgressFailure({ status, body: text }) === 'blocked';
+            if (blocked && transport === 'direct' && this.proxyAvailable) {
+                return { ...FAILED_TEXT(url, transport, status, true), retryWith: 'proxy', reason: 'blocked_direct_body' };
+            }
+            return { text: blocked ? '' : text, url, ok: !blocked, status, transport, blocked };
+        }
+        catch (error) {
+            await this.cancel(response);
+            if (transport === 'proxy' && isProxyUnreachable(error)) {
+                this.proxyEverReachable = false;
+                return { ...FAILED_TEXT(url, transport), retryWith: 'direct', reason: 'proxy_unreachable' };
+            }
+            // Same fallback the url mode has always applied: curl handles a proxy or
+            // a self-signed/intercepted TLS chain that Node's fetch rejects.
+            if (this.curlFetch && (isTlsFailure(error) || classifyEgressFailure({ error }) === 'transient')) {
+                this.attempts += 1;
+                try {
+                    const text = await this.curlFetch(url, transport === 'proxy' ? this.policy.proxyUrl : '');
+                    if (text.trim()) {
+                        return { text, url, ok: true, status: 200, transport, blocked: false };
+                    }
+                }
+                catch {
+                    // Fall through to the failure result below.
+                }
+            }
+            return FAILED_TEXT(url, transport);
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
+    async drain(response, limit) {
+        if (!response)
+            return '';
+        try {
+            const text = await response.text();
+            return text.slice(0, limit);
+        }
+        catch {
+            return '';
+        }
+    }
+    async cancel(response) {
+        try {
+            await response?.body?.cancel?.();
+        }
+        catch {
+            // Already consumed or already closed.
+        }
+    }
+    /** Fetch a URL as text under the current transport, switching once if needed. */
+    async text(url, timeoutMs) {
+        if (this.closed)
+            throw new Error('egress session is closed');
+        const first = await this.attempt(url, timeoutMs, this.current);
+        if (!first.retryWith)
+            return first;
+        this.switchTo(first.retryWith, first.reason ?? 'retry');
+        const second = await this.attempt(url, timeoutMs, this.current);
+        const { retryWith: _ignored, reason: _reason, ...rest } = second;
+        return rest;
+    }
+    async close() {
+        this.closed = true;
+        const dispatcher = this.dispatcher;
+        this.dispatcher = null;
+        if (dispatcher) {
+            try {
+                await dispatcher.destroy();
+            }
+            catch {
+                // Destroy is best-effort; a dead proxy must not fail the run.
+            }
+        }
+    }
+}

package/dist/pipeline/extract.js

@@ -1,5 +1,6 @@
 import crypto from 'node:crypto';
 import { spawn as defaultSpawn } from 'node:child_process';
+import { EgressSession, resolveEgressPolicy, defaultCurlFetch as egressCurlFetch } from './egress.js';
 function defaultRandomInt(start, end) {
     return Math.floor(Math.random() * (end - start + 1)) + start;
 }
@@ -135,11 +136,9 @@ function isEnabled(value) {
     return ['1', 'true', 'yes', 'on'].includes(String(value ?? '').trim().toLowerCase());
 }
 function resolveUpstreamProxyUrl(env) {
-    if (!isEnabled(env.VPN_AUTOMATION_USE_UPSTREAM_PROXY)) {
-        return '';
-    }
-    const value = String(env.VPN_AUTOMATION_UPSTREAM_PROXY ?? 'http://127.0.0.1:7897').trim();
-    return ['', 'off', 'none', 'false', '0'].includes(value.toLowerCase()) ? '' : value;
+    // One resolver for both extract modes, so a run cannot half-use a proxy.
+    const policy = resolveEgressPolicy(env);
+    return policy.mode === 'direct' ? '' : policy.proxyUrl;
 }
 function isTlsFailure(error) {
     const text = error instanceof Error
@@ -201,10 +200,29 @@ function defaultCurlFetch(url, proxyUrl, spawn = defaultSpawn) {
 function emitExtractEvent(options, type, payload) {
     options.eventCallback?.(type, payload);
 }
-async function fetchSourceText(input, url, attempt, fetchImpl, options, upstreamProxy) {
+async function fetchSourceText(input, url, attempt, fetchImpl, options, upstreamProxy, session) {
+    // The shared session is the egress authority for both modes: it owns the
+    // proxy dispatcher, cancels abandoned bodies and switches direct -> proxy
+    // when the vendor starts answering with a block page.
+    if (session) {
+        const result = await session.text(url, 20_000);
+        const via = result.transport === 'proxy' ? 'upstream_proxy' : 'direct';
+        emitExtractEvent(options, 'extract_request_result', {
+            source_name: input.source_name,
+            iteration: attempt,
+            success: result.ok,
+            via,
+            ...(result.ok ? {} : { error: result.blocked ? 'blocked' : `HTTP ${result.status}` })
+        });
+        if (!result.ok) {
+            throw new Error(result.blocked ? 'egress blocked' : `HTTP ${result.status}`);
+        }
+        return { text: result.text, via };
+    }
     try {
         const response = await fetchWithTimeout(fetchImpl, url, 20_000);
         if (response.ok === false || Number(response.status ?? 200) >= 400) {
+            await response.body?.cancel?.();
             throw new Error(`HTTP ${Number(response.status ?? 0)}`);
         }
         const text = await response.text();
@@ -270,88 +288,104 @@ async function fetchSourceLinksInNode(input, options) {
     let failures = 0;
     const startedAt = Date.now();
     const upstreamProxy = resolveUpstreamProxyUrl(options.env ?? process.env);
+    const session = await EgressSession.open(options.env ?? process.env, {
+        fetchImpl: fetchImpl,
+        curlFetch: options.curlFetch ?? ((url, proxyUrl) => egressCurlFetch(url, proxyUrl, options.spawn)),
+        // The switch has to be visible in the run log for both extract modes; a
+        // credential source logs it from its own wrapper, a url source from here.
+        onSwitch: (switched) => emitExtractEvent(options, 'log', {
+            message: `[extract][${input.source_name}] egress ${switched.from} -> ${switched.to} (${switched.reason})`
+        })
+    });
     emitExtractEvent(options, 'extract_source_started', {
         source_name: input.source_name,
         requested_iterations: maxIterations,
         min_iterations: minIterations,
         resume_from_iteration: startIteration
     });
-    for (let iteration = startIteration - 1; iteration < maxIterations; iteration += 1) {
-        const attempt = iteration + 1;
-        if (maxRuntimeSeconds > 0 && attempt > minIterations && (Date.now() - startedAt) / 1000 >= maxRuntimeSeconds) {
-            break;
-        }
-        try {
-            const url = buildRuntimeSourceUrl(source, iteration);
-            const response = await fetchSourceText(input, url, attempt, fetchImpl, options, upstreamProxy);
-            let plaintext = '';
-            try {
-                plaintext = decryptPayload(response.text.trim(), source.key);
-                emitExtractEvent(options, 'extract_decrypt_result', {
-                    source_name: input.source_name,
-                    iteration: attempt,
-                    success: true
-                });
+    try {
+        for (let iteration = startIteration - 1; iteration < maxIterations; iteration += 1) {
+            const attempt = iteration + 1;
+            if (maxRuntimeSeconds > 0 && attempt > minIterations && (Date.now() - startedAt) / 1000 >= maxRuntimeSeconds) {
+                break;
             }
-            catch (decryptError) {
-                emitExtractEvent(options, 'extract_decrypt_result', {
+            try {
+                const url = buildRuntimeSourceUrl(source, iteration);
+                const response = await fetchSourceText(input, url, attempt, fetchImpl, options, upstreamProxy, session);
+                let plaintext = '';
+                try {
+                    plaintext = decryptPayload(response.text.trim(), source.key);
+                    emitExtractEvent(options, 'extract_decrypt_result', {
+                        source_name: input.source_name,
+                        iteration: attempt,
+                        success: true
+                    });
+                }
+                catch (decryptError) {
+                    emitExtractEvent(options, 'extract_decrypt_result', {
+                        source_name: input.source_name,
+                        iteration: attempt,
+                        success: false,
+                        error: decryptError instanceof Error ? `${decryptError.constructor.name}: ${decryptError.message}` : String(decryptError)
+                    });
+                    throw decryptError;
+                }
+                const extracted = extractLinksFromPlaintext(input.source_name, plaintext);
+                successes += 1;
+                failures = 0;
+                let newItems = 0;
+                const newLinks = [];
+                const newItemFingerprints = [];
+                for (const link of extracted) {
+                    if (seen.has(link)) {
+                        continue;
+                    }
+                    seen.add(link);
+                    links.push(link);
+                    newLinks.push(link);
+                    newItems += 1;
+                    newItemFingerprints.push(linkFingerprint(link));
+                }
+                emitExtractEvent(options, 'extract_iteration', {
                     source_name: input.source_name,
                     iteration: attempt,
-                    success: false,
-                    error: decryptError instanceof Error ? `${decryptError.constructor.name}: ${decryptError.message}` : String(decryptError)
+                    requested_iterations: maxIterations,
+                    new_items: newItems,
+                    extracted_links: extracted.length,
+                    total_links: links.length,
+                    deduped_links: links.length,
+                    new_item_fingerprints: newItemFingerprints
                 });
-                throw decryptError;
-            }
-            const extracted = extractLinksFromPlaintext(input.source_name, plaintext);
-            successes += 1;
-            failures = 0;
-            let newItems = 0;
-            const newLinks = [];
-            const newItemFingerprints = [];
-            for (const link of extracted) {
-                if (seen.has(link)) {
-                    continue;
+                if (newItems > 0) {
+                    await options.linksCallback?.(newLinks);
+                }
+                plateau = newItems === 0 ? plateau + 1 : 0;
+                if (plateau >= plateauLimit && attempt >= minIterations) {
+                    break;
                 }
-                seen.add(link);
-                links.push(link);
-                newLinks.push(link);
-                newItems += 1;
-                newItemFingerprints.push(linkFingerprint(link));
-            }
-            emitExtractEvent(options, 'extract_iteration', {
-                source_name: input.source_name,
-                iteration: attempt,
-                requested_iterations: maxIterations,
-                new_items: newItems,
-                extracted_links: extracted.length,
-                total_links: links.length,
-                deduped_links: links.length,
-                new_item_fingerprints: newItemFingerprints
-            });
-            if (newItems > 0) {
-                await options.linksCallback?.(newLinks);
-            }
-            plateau = newItems === 0 ? plateau + 1 : 0;
-            if (plateau >= plateauLimit && attempt >= minIterations) {
-                break;
-            }
-        }
-        catch (error) {
-            failures += 1;
-            if (failures >= failureLimit) {
-                break;
             }
-            if (attempt >= maxIterations) {
-                throw new Error(`Node extract request failed: ${error instanceof Error ? error.message : String(error)}`);
+            catch (error) {
+                failures += 1;
+                if (failures >= failureLimit) {
+                    break;
+                }
+                if (attempt >= maxIterations) {
+                    throw new Error(`Node extract request failed: ${error instanceof Error ? error.message : String(error)}`);
+                }
             }
         }
     }
+    finally {
+        await session.close();
+    }
     emitExtractEvent(options, 'extract_source_completed', {
         source_name: input.source_name,
         requested_iterations: maxIterations,
         successful_iterations: successes,
         failed_iterations: failures,
-        raw_links: links.length
+        raw_links: links.length,
+        egress_transport: session.transport,
+        egress_switches: session.switches.length
     });
     return {
         source_name: input.source_name,
@@ -385,7 +419,12 @@ export async function fetchSourceLinksWithBackend(input, options = {}) {
             successful_iterations: result.successful_iterations,
             failed_iterations: result.failed_iterations,
             links: result.links,
-            errors: result.diagnostics.errors
+            errors: result.diagnostics.errors,
+            // Without these the orchestrator could only report the requested cap,
+            // so an early-stopped 1000-round run still read as 1000/1000.
+            rounds: result.diagnostics.rounds,
+            rounds_total: result.diagnostics.rounds_total,
+            platforms: result.diagnostics.platforms
         };
     }
     return fetchSourceLinksInNode(input, options);